KaraZajac
754af4134a
Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the D4C1-Labs/Flipper-ARF firmware: ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static, Honda V1, Land Rover V0. Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4, Porsche Cayenne, PSA2. Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it cannot false-match existing protocols; every previously-decoding IMPORTS capture decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static (Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the rest are validated by encode/decode round-trip and synthetic-frame tests. Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt (15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap; release behavior unchanged). Adds per-protocol docs, updates the README protocol table, capture metadata (encoding / RF / encryption), make-suggestion mapping, and CHANGELOG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73
2.9 KiB
layout
| layout |
|---|
| default |
Honda V1 Protocol
Rust module: src/protocols/honda_v1.rs
Reference: REFERENCES/ProtoPirate/protocols/honda_v1.c
Overview
Honda/Acura fixed-code keyfobs — a DIFFERENT protocol from honda_static. The on-wire frame carries 68
bits: 64-bit data + a 4-bit CRC-fold nibble. Encoding is short/long pulse PWM, glued together by a
"pending bit" timing accumulator before classification: sub-te_delta runts are summed into pending;
a HIGH level extends the running HIGH pulse; a LOW flushes the accumulated HIGH (if it reached
te_short_min) as a synthetic symbol, then classifies the LOW.
Validation is a button-code table (Unlock=0, Lock=8, Trunk=9, Panic=10) plus a CRC-fold checksum.
Emission is gated on the button being valid; crc_valid reflects whether the received CRC nibble matches
either wire-order checksum. The strong button gate keeps Honda V1 from false-matching.
Timing
| Parameter | Value | Notes |
|---|---|---|
| Short | 1000 µs | ±400 µs (te_delta) |
| Long | 2000 µs | ±400 µs |
| Short min | 600 µs | flush threshold for HIGH |
| End gap | 3500 µs | >te_end commits the frame |
| Min bits | 68 |
Frame Layout (68 bits = 64-bit data + 4-bit CRC nibble)
After the end gap, commit left-shifts the 12-byte bit buffer to drop leading preamble leakage and align
the trailing 68-bit frame. data = first 8 bytes (64 bits); the CRC nibble = byte 8's high nibble.
- data[63:36]: serial (28-bit)
- data[31:28]: button (nibble) — Unlock=0, Lock=8, Trunk=9, Panic=10
- data[15:0]: counter (16-bit)
- CRC nibble: CRC-fold checksum (
honda_v1_checksum*), validated against either wire-order value
RF
- Encoding: short/long pulse PWM with pending-bit timing accumulation
- RF modulation: AM (OOK)
- Encryption: none — gated on the button-code table + CRC-fold checksum
- Frequencies: 315 MHz, 433.92 MHz
Decoder Steps
- feed — accumulate sub-
te_deltarunts intopending; flush HIGH pulses and classify LOW pulses into symbols. - symbol — Reset → Preamble (short/long pulses, needs a long + >5 count) → Data.
- Data — pending-bit accumulation: a short pulse toggles
data_pendingand emits a bit when paired; a long pulse emits directly. After a >te_end gap, commit: align the 68-bit frame, validate the button, and emit.
Encoder
Supported (ENABLE_EMULATE_FEATURE). Builds the 64-bit key from serial/button/counter via the button code table, then emits a 180-element short-pair preamble + 4 PWM frames (2 per checksum wire value).
Validation
Verified by an encode→decode round-trip / synthetic-frame check (no local capture available). Unit tests cover the key/field round trip, full encode→decode, and the button-validity mask.